Vulnerability Report

CVE-2026-41456

Title: Reflected XSS in Bludit CMS search plugin

XSS

Proof Of Concept

PoC Available for CVE-2026-41456

CWE Category CWE-79
Published Date Apr 21, 2026
Modified Date Jul 14, 2026
Exploit Status Available
Score 5.1 CVSS v4.0
Exploit Probability (EPSS)
2.72%

Vulnerability Summary

CVE-2026-41456: Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.

Impacted Vendors

Analysis in Progress...

Reference Links

https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01 https://github.com/bludit/bludit/pull/1691 https://www.vulncheck.com/advisories/bludit-cms-reflected-xss-via-search-plugin
CVSS v4.0
Source Entity [email protected]
Severity MEDIUM
5.1
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
ACTIVE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
N/A
RAW VECTOR CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-41456 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/52678
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction ACTIVE
CVSS Vector String CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Stack

No specific products linked.